As you learned yesterday, there is global static config and more local dynamic config, with labels usually related to target services in a container.
If the cert is used by multiple services, I would place it on static command to be used globally, otherwise on the related service dynamic labels config.